W Release Notes

Transcription

1 W Release Notes Abstract This document contains supplemental information for the W release. Part Number: Published: March 2017 Edition: 1

2 2017 Hewlett Packard Enterprise Development LP Notices The information contained herein is subject to change without notice. The only warranties for Hewlett Packard Enterprise products and services are set forth in the express warranty statements accompanying such products and services. Nothing herein should be construed as constituting an additional warranty. Hewlett Packard Enterprise shall not be liable for technical or editorial errors or omissions contained herein. Confidential computer software. Valid license from Hewlett Packard Enterprise required for possession, use, or copying. Consistent with FAR and , Commercial Computer Software, Computer Software Documentation, and Technical Data for Commercial Items are licensed to the U.S. Government under vendor's standard commercial license. Links to third-party websites take you outside the Hewlett Packard Enterprise website. Hewlett Packard Enterprise has no control over and is not responsible for information outside the Hewlett Packard Enterprise website. Acknowledgments Microsoft and Windows are either registered trademarks or trademarks of Microsoft Corporation in the United States and/or other countries.

3 Contents W Release Notes... 6 Description... 6 Important information... 6 Version history...6 Products supported...8 Compatibility/interoperability... 8 Minimum supported software versions... 8 Enhancements... 9 Version W Version W Version W Version W Version W Version W Version W Version W Version W Additional Debug Capability... 9 Version W Version W Hostname Version W Version W Version W Certificate Manager Chassis Locate LED...10 DHCPv4 Snooping Filtering PVID Messages...10 Local MAC Authentication SNMP Trap Fixes...11 Version W IP Stacking...11 LLDP...11 Version W Online Help...12 Spanning Tree Web UI...12 Version W Config Crash...12 PoE...12 Routing SFTP Version W X Certificate Manager CLI...13 Crash...14 Routing Contents 3

4 4 Contents SSH SSL...14 Stacking...14 Version W Certificate Manager CLI...15 Crash...15 SSH TFTP...15 Version W ARP CLI...16 Config Crash...16 ICMP...17 IP Phones...17 Memory...18 Redundant Memory...18 Smart Link Stacking...18 Switch Hang TACACS Version W X CLI...19 PoE...19 Switch Hang Version W Crash...19 Version W Authentication...19 BPDU Protection CLI...20 IPv Logging...20 Management...20 PoE...21 sflow SNMP Switch Hang TELNET...21 Web Management Version W CLI...22 Counters...22 Crash...22 Display Issue Fastboot...23 Flow Control IGMP IP Phones...23 MAC Table...23 MSTP...24 Multicast Stacking...24 Transceivers Version W

5 RADIUS...24 Version W Version W Version W X Accounting...25 Authentication...25 CLI...25 Config Crash...26 DHCP Event Log GVRP ICMP...27 IGMP Jumbo Frames...27 Link...27 Loop Protection MAC Authentication...28 OpenFlow Passwords...28 RADIUS Accounting Routing sflow SNMP SSH SSL...29 Stacking...29 TFTP...29 Transceivers Trunking...30 Web Management Upgrade information Hewlett Packard Enterprise security policy Finding Security Bulletins...31 Security Bulletin subscription service...31 Websites Support and other resources...33 Accessing Hewlett Packard Enterprise Support Accessing updates...33 Customer self repair...33 Remote support Warranty information...34 Regulatory information...34 Documentation feedback Contents 5

6 W Release Notes Description This release note covers software versions for the W branch of the software. Version W was the initial release of Major version W software. W software was built from the same source as W W includes all enhancements and fixes in W software, plus the additional enhancements and fixes in the W enhancements and fixes sections of this release note. Product series supported by this software: HPE 2910al Switch Series Important information To avoid damage to your equipment, do not interrupt power to the switch during a software update. Version history All released versions are fully supported by Hewlett Packard Enterprise, unless noted in the table. Version number Release date Based on Remarks W W Released, fully supported, and posted on W W Released, fully supported, and posted on W W Released, fully supported, and posted on W W Released, fully supported, and posted on W W Released, fully supported, and posted on W W Released, fully supported, and posted on W W Released, fully supported, and posted on W W Released, fully supported, but not posted on W W Released, fully supported, and posted on W W Released, fully supported, but not posted on W W Released, fully supported, but not posted on W n/a Never built. Table Continued 6 W Release Notes

7 Version number Release date Based on Remarks W n/a Never built. W W Initial release of W.15.14, fully supported, and posted on the web for early availability. W W Please see the W release note for detailed information on the W branch. Released, fully supported, and posted on W W Released, fully supported, and posted on W W Released, fully supported, but not posted on W n/a W Never released. W n/a W Never released. W n/a W Never released. W W Released, fully supported, and posted on W n/a Never built. W W Released, fully supported, but not posted on W W Released, fully supported, and posted on W W Released, fully supported, but not posted on W W Initial release of W.15.13, fully supported, and posted on the web for early availability. W W Please see the W release note for detailed information on the W branch. Released, fully supported, but not posted on W W Released, fully supported, and posted on W W Released, fully supported, and posted on W n/a Never built. W W Released, fully supported, but not posted on W W Released, fully supported, and posted on W W Released, fully supported, but not posted on W n/a Never built. Table Continued W Release Notes 7

8 Version number Release date Based on Remarks W W Released, fully supported, but not posted on W W Released, fully supported, but not posted on W First release Initial release of W.15.12, fully supported, but not posted on Products supported This release applies to the following product models: Product number J9145A J9147A J9146A J9148A Description HPE 2910al 24G Switch HPE 2910al 48G Switch HPE 2910al 24G PoE+ Switch HPE 2910al 48G PoE+ Switch Compatibility/interoperability The switch web agent supports the following web browsers: Browser Supported versions Internet Explorer Edge 11 Chrome Firefox Safari (MacOS only) 10 9 Minimum supported software versions NOTE: If your switch or module is not listed in the below table, it runs on all versions of the software. Table sorted by minimum supported software version (reverse chronological order) Product number Product name Minimum software version J9805A HPE 640 Redundant/External PS Shelf WB Products supported

9 Enhancements This section lists enhancements added to this branch of the software. Software enhancements are listed in reverse-chronological order, with the newest on the top of the list. Unless otherwise noted, each software version listed includes all enhancements added in earlier versions. Version W No enhancements were included in version W Version W No enhancements were included in version W Version W No enhancements were included in version W Version W No enhancements were included in version W Version W No enhancements were included in version W Version W No enhancements were included in version W Version W No enhancements were included in version W Version W No enhancements were included in version W Version W Additional Debug Capability CR_ This enhancement adds tracking to identify possible switch hang situations during switch boot. Version W No enhancements were included in version W Enhancements 9

10 Version W Hostname CR_ Hostname in Syslog Messages. The switch can be configured to include its hostname as the source or "origin" for messages sent to a syslog server. For more information, see "Troubleshooting" in the Management and Configuration Guide for your switch. Version W Version W was never built. Version W Version W was never built. Version W Certificate Manager CR_ Certificate Manager. Certificate Manager enables Public Key Infrastructure (PKI) capability on the switch providing authentication of network entities. See "Certificate Manager" in the HP Switch Software Access Security Guide for your switch. Chassis Locate LED CR_ Chassis Locate LED at Boot. The chassislocate command has an optional parameter that configures it to run in the future instead of immediately. See "Troubleshooting" in the HP Switch Software Management and Configuration Guide for your switch. DHCPv4 Snooping CR_ DHCPv4 Snooping Max Binding. DHCP snooping max-binding prevents binding entries from getting exhausted. This feature is on a per-port basis and restricts the maximum number of bindings allowed on a port/interface. The maximum bindings for a particular port includes both statically configured and dynamically learned. The number of bindings on a per port basis is incremented upon a lease offer and decremented upon a lease expiry or release. See "Port Security" in the HP Switch Software Access Security Guide for your switch. Filtering PVID Messages CR_ Filtering PVID Mismatch Log Messages. This enhancement filters out PVID mismatch log messages on a per-port basis. PVID mismatches are logged when there is a difference in the PVID advertised by a neighboring switch and the PVID of the switch port which receives the LLDP advertisement. However, if these events are logged too frequently, they can overwhelm the log buffer and push relevant logging data out of log memory, making it difficult to troubleshoot another issue. See "Troubleshooting" in the HP Switch Software Management and Configuration Guide for your switch. 10 Version W

11 Local MAC Authentication CR_ SNMP Trap Local MAC Authentication (LMA). LMA is a software feature that simplifies deployment for devices such as IP phones and security cameras. In general, it provides dynamic attribute assignment (e.g., VLAN and QoS) through the use of a locally configured authentication repository. The most common use model for LMA is to automatically assign a VLAN to IP phones. In some cases, it can also provide rudimentary access security for the network. See "Web and MAC Authentication" in the HP Switch Software Access Security Guide for your switch. CR_ Fixes SNMP Trap When MAC Address Table Changes. This enhancement causes an SNMP trap to be generated once a laptop/pc is removed from the back of an IP phone and the laptop/pc MAC address ages out of the MAC table. See "Configuring for Network Management Applications" in the HP Switch Software Management and Configuration Guide for your switch. This section lists released builds that include fixes found in this branch of the software. Software fixes are listed in reverse-chronological order, with the newest on the top of the list. Unless otherwise noted, each software version listed includes all fixes added in earlier versions. The Symptom statement describes what a user might experience if this is seen on the network. The Scenario statement provides additional environment details and trigger summaries. When available, the Workaround statement provides a workaround to the issue for customers who decide not to update to this version of software. NOTE: The number that precedes the fix description is used for tracking purposes. Version W IP Stacking CR_ LLDP Symptom: IP communication between members of an IP stack may fail. Scenario: When 2 or more switches are configured with IP stacking and the IP address configuration on the Primary VLAN is disabled (no ip address) on a stack member switch, the IP communication between commander switch and a stack member, such as ping <switch-number> or telnet <switch-number>, fails after the stack member reboot. Workaround: Do not disable the IP address (no ip address) on the stack member switch. CR_ Symptom: Chassis ID field is not displayed in the output of CLI command show lldp info <localdevice remote device>. Scenario: The switch does not display the local Chassis ID information in the output of the CLI command show lldp info local-device. The Chassis ID for remote devices is empty in the output of CLI command show lldp info remote device. Local MAC Authentication 11

12 Version W Online Help CR_ Symptom: Web management help file is not accessible. Scenario: The web management interface online help file URL changed to accommodate domain change for host files. Spanning Tree CR_ Web UI Symptom: Incorrect spanning tree hello time is reported as a MIB value. Scenario: In a spanning tree topology, the switch reports the value of OID dot1dstphellotime on a root switch in seconds instead of centiseconds as reported in non-root switches. Workaround: There is no impact on spanning tree functionality as this is merely a value conversion from seconds to centiseconds. CR_ Symptom: Switch may crash during authentication to access Web UI management interface. Scenario: When using a Windows Network Policy Server as RADIUS server for the switch authentication mechanism to control web access to the switch management, the switch may crash with an error message similar to Health Monitor: Read Error Restr Mem Access <...> Task='tHttpd' <...>. Version W Config CR_ Crash When a change is made from the CLI in the 'Switch Configuration Port/Trunk Settings' Menu, the change is not saved, resulting in an Unable to save field error. CR_ PoE The switch may reboot unexpectedly at the point when an IGMP static group is created in the configuration if an IGMP join occurs to the same group address. CR_ Symptom: The switch crashes when the CLI commands show tech or show tech all are executed. Scenario: When there is a faulty module, running the CLI commands show tech or show tech all might cause the switch to crash with an error message similar to Software exception at samba_chassis_slot_sm <...> Co-Processor Crash detected <...>. 12 Version W

13 Routing Workaround: Replace the faulty PoE module or do not run the CLI commands show tech or show tech all when the switch indicates a PoE module failure on the front panel LED status. CR_ SFTP Under stress conditions, the switch sometimes enters a state where it does not send an ARP to a particular destination and it becomes unreachable on the customer network. Workaround: Initiate a ping from the switch to the unreachable destination to restore connectivity to that destination through this switch. CR_ Management modules go out of synchronization and fail to recover when large SFTP copies or a large number of SFTP copies are performed. Version W X CR_ x re-authentication period works if the client connects after the switch is booted. If, however, the switch reboots while clients are connected, it authenticates initially, but no re-authentication occurs. Certificate Manager CR_ CLI When an IDEVID certificate is being used to establish TLS connections with a CNM server, the existing signature algorithm has been updated from SHA-1 to DER, with new root certificate for the RA server. CR_ The output of the CLI command show interface ethernet <interface> becomes misaligned when the value of Total Rx (bps) reaches 100,000,000. When the 9th digit is added to the value of Total Rx, the adjacent line in the output (Total Tx (bps)) is shifted one column farther. CR_ After issuing the CLI command clear statistics global, two problems might appear in the output of show interface ethernet <port ID>: 1. The values of Bytes Rx and Bytes Tx are no longer displayed as comma-separated values. This applies to counter values from 2,147,483,647 through 4,294,967,295. Other counters than the number of bytes sent and received also appear to be affected by the same display issue (for example, Unicast counters and Deferred Tx). 2. After entering clear stat global, the format of the output of show interface ethernet <port> shifts two places. The missing space might appear at Giant Rx Late Collisions, but where the space is added seems can differ. Routing 13

14 Crash CR_ Routing The switch may reboot unexpectedly when the management interface is accessed via SSH and the show tech all CLI command is executed, or when the SSH session is idle following execution of the CLI command show run a few minutes earlier. CR_ The IP RIP Route Change counter might increment every 30 seconds, even though there is no actual change taking place. CR_ SSH When multiple ECMP routes are used with BGP, MSTP, and VRRP issues resulted due to message queues becoming full. CR_ SSL When the SSH client has a keepalive mechanism configured that requires a response from the SSH server on the switch, the SSH client will terminate the session after the first keepalive packet is transmitted. This happens because the switch drops the client s keepalive packet due to an incorrect packet length calculation. This issue has been observed using an openssh client with the ServerAliveInterval configured and the parameter want_reply enabled. CR_ Stacking SSL Security vulnerability due to 56 bit DES-CBC-SHA. Due to security vulnerability the cipher DES- CBC-SHA is now unavailable. CR_ If IP stacking is configured, and a user connects via browser to the stack commander via its (http) web management address and selects the drop down box to connect to a stack member, the user is not connected to the stack member and is returned back to the stack commander view instead. Version W Certificate Manager CR_ When a self-signed certificate is generated in the CLI, the certificate does not contain a valid start and end-date. This causes the certificate to be invalid, which causes problems establishing HTTPS sessions or using syslog over TLS. When the self-signed certificate is generated in the web interface, this problem does not occur. 14 Crash

15 CLI CR_ When a user enables Spanning Tree in the CLI and configured a protocol version other than the default MSTP, the CLI Menu does not allow the user to modify Spanning Tree parameters. The menu indicates that the switch requires a reboot. When the switch is actually rebooted, the same problem is present after the reboot. CR_ Crash After a user changes the Spanning Tree Protocol Version to RPVST in the CLI Menu, the switch prompts the user to save the configuration and reboot the system to activate the changes. However, after saving and rebooting, those messages continue to be displayed. CR_ When an exceptionally large amount of IP Address Manager (IPAM) output is generated by the show tech all command and captured using the copy command-output CLI command, the system might crash with the following message: NMI event SW:IP=0x MSR:0x LR: 0x00120f7c cr: 0x sp:0x04d60f30 xer:0x Task='mSess3' Task ID=0x4d CR_ The switch might reboot unexpectedly with a Software Exception message similar to: Software exception at stackingfile.c: in 'mstackdatwriter', task ID = 0x3c953b00 -> Internal Error ID: 6382d706) when a lot of TFTP file transfers to an external TFTP server occur. CR_ SSH When the switch continuously attempts to transfer a file to a destination that returns an error; for example, because it ran out of space to store the file, the switch might eventually crash with the message: Software exception at hwbp.c: in 'fault_handler', task ID = 0x3c > MemWatch Trigger: Offending task 'mfttask'. CR_ TFTP When a user copies a large file from the switch to a server using the SFTP client on the switch, the file transfer might be prematurely interrupted because the session disconnects before the file transfer has been completed. When this occurs, the following message is recorded in the system s Event Log: sftp: AM1: User: SFTP connection failure while connecting from <ip address>. CR_ When the switch is used as a TFTP server and configuration files are transferred from the switch to an external TFTP client, the software creates a temporary file in memory that is removed after the transfer has completed. However, the temporary file is not deleted when an error occurs during the file transfer. When repeated file transfers of configuration files fail, the temporary files accumulate and might deplete the available memory space. Once depleted, further file transfers fail and the switch might reboot CLI 15

16 unexpectedly (crash). Note that when the switch is rebooted, all temporary files are removed from memory. Version W ARP CR_ CLI Changing the ip arp-age value should apply to existing ARP cache entries, but it does not. CR_ When the switch is configured with the console event critical setting, the event log output of show tech all lists only the critical events. With this fix, show tech all lists all event log entries. CR_ The output of show tech all halts while displaying lmadbutil traverselmaproftbl, with the message === The command has completed with errors. ===. CR_ Config The output of show run lists modules that are not installed in the switch. The nonexistent modules are also in the config file. This fix improves the original CLI fix (CR_ ). CR_ The switch prompts users to save the configuration when no changes have been made. This has been observed after configuring meshing, saving the config, and rebooting the switch. CR_ Crash Routing must be enabled before the Local Proxy-ARP feature can be configured, but when routing is removed from the configuration, the Local Proxy-ARP configuration is not removed. CR_ In a rare situation, after a failover to the Standby Management Module (SMM) or the stack's Standby switch, the switch might reboot unexpectedly with a message similar to Software exception at asicmgrslavefilters.c: in 'mnsa', task ID = 0x1b1fea80 -> Internal Name Server Error. CR_ After deleting the last of any configured Smart Link groups, the switch might reboot unexpectedly. CR_ With MAC-based authentication and mixed-mode enabled on a port that has both authenticated and unauthenticated clients, a redundancy failover might cause the switch to reboot unexpectedly with a message similar to Software exception at bttfhwsrcbasedvlan.c: in 'madmupctrl', task ID = 0x1fecc6c0 -> ASSERT: failed. 16 Version W

17 CR_ When a large number of 802.1X clients are being authenticated, reconfiguring port security modes such as learn-mode might cause the switch to reboot unexpectedly with a message similar to Software exception at multmgmtutil.c:88 -- in 'mppmgrctrl', task ID = 0x13b1f940 -> Internal error. CR_ The switch experiences a loss of free memory for failed PEAP-MSCHAPv2 MAC-based authentication requests. When memory is no longer available, the switch reboots unexpectedly with a message similar to Software exception at wma_peap.c: in 'mwebauth', task ID = 0x1de > ASSERT: failed. CR_ Enabling the arp-protect command on 4094 VLANs causes CPU utilization to increase to 100%. CR_ Disabling and re-enabling a port configured for Web or MAC-authentication during client authentication might cause the switch to reboot unexpectedly with a message similar to Health Monitor: Restr Mem Access HW Addr=0xb1ba0c1a IP=0x108682b8 Task='mWebAuth' Task ID=0x1de8c680 sp:0x12f98530 lr:0x msr: 0x0000b032 xer: 0x cr: 0x CR_ When a CLI command is entered with a backslash as the last character and then the repeat command is issued, the switch might reboot unexpectedly with a message similar to Task msess1 encountered an exception. CR_ Sending an ICMPv6 echo request packet with multiple fragment headers to the switch causes an NMI crash. CR_ ICMP When using MAC Authentication on 2620, the following software exception may occur: wma_client_sm.c: in 'mwebauth', task ID = 0x1de CR_ IP Phones The switch sends a ping request to a random IP address every 20 minutes. CR_ If an IP phone sends the switch an invalid power value of zero watts in an LLDP-MED TLV, the switch log shows PD Over Current indication and the phone might continuously reboot. This has been observed with the Avaya 9641G IP phone. ICMP 17

18 Memory CR_ Issuing the terminal length or terminal width command causes a small loss of free memory. Redundant Memory CR_ Smart Link After redundancy switchover with boot command when modules have not finished booting an internal buffer may become corrupted. This could possibly lead to a crash. CR_ Upstream switches do not flush the MAC and ARP entries after a Smart Link switchover. CR_ After deleting the active Master port from a Smart Link group, the Slave port takes over but does not send flush packets. CR_ Stacking When Spanning Tree is enabled after Smart Link is configured, the Smart Link ports incorrectly take part in Spanning Tree. CR_ When configured for IP Stacking, the commander or stack member does not respond to packets that are 1461 bytes or greater. Switch Hang CR_ TACACS Attempting to apply a 32-character local-mac profile name to a 32-character local-mac mac-group name causes the switch to become unresponsive, requiring a reboot to recover. CR_ TACACS authentication is not working with encrypt credentials in FIPS devices. Version W X CR_ Already-authenticated clients that send an EAPOL-Start message are de-authenticated by the switch. This situation happens if the client runs Windows Vista and later operating systems that are set to "include learning". 18 Memory

19 CLI CR_ PoE The output of show tech all halts while displaying hw aqread pbf cm, with the message === The command has completed with errors. ===. CR_ Some Unify IP phones exhibit a PoE incompatibility with some HPE switches, which might result in a hard failure of the phone. For more information, see the customer advisory at hpsc/doc/public/display?docid=c &lang=en-us&cc=us. Switch Hang CR_ If the switch is sending output to the console at the time the switch is rebooted, the switch might hang and not boot properly. Version W Crash CR_ With multiple authentication protocols active in a high-stress environment, the switch might reboot unexpectedly with a message similar to NMI event HW:IP=0x c MSR:0x LR: 0x cr: 0x sp:0x02d56220 xer:0x Task='tDevPollRx' Task ID=0x2d3fc78. Version W Authentication CR_ A switch configured with RADIUS authentication for primary login, and local authentication for secondary login fails to use local authentication when RADIUS servers do not respond. In that situation, the switch console is not accessible to valid users. This fix was inadvertently omitted from the original W fix list. BPDU Protection CR_ If VLAN 1 is not enabled on the link between a switch running rapid PVST and a switch running any Spanning Tree version, a rapid PVST switch configured for BPDU protection does not shut down the port when it receives a BPDU from the neighboring switch. However, the BPDUs are correctly dropped. This fix was inadvertently omitted from the original W fix list. CLI 19

20 CLI CR_ The output of show tech halts after displaying show debug buffer, with the message === The command has completed with errors. ===. CR_ A new command tcp-push-preserve is added. This command is enabled by default, and causes TCP packets with the "push" flag to be sent before other packets in the queue. Note that high concentrations of TCP packets with push flags under certain conditions can destabilize your network. Use the no form of this command to disable the feature. CR_ On a 2910al switch with no modules inserted, the output of show modules incorrectly lists two modules. CR_ IPv6 When the output of show power-over-ethernet brief displays a Detection Status of either Searching or Delivering for a port, the show tech all "poe_status_port all" section displays Other Fault as the Detect Stat. CR_ Logging IPv6 Router Advertisements that indicate an off-link prefix are not set as "preferred" in the switch, which causes incorrect information in the output of show ipv6, and can affect connectivity to hosts that use IPv6 Stateless Address Autoconfiguration. This issue also causes the sflow "Agent Address" to be listed as CR_ In an IPv4 plus IPv6 environment, upon switch bootup the event log displays the set of source IP policy ("srcip") messages twice. With this fix, IPv6 policy messages are distinguished from IPv4 policy messages. CR_ Some RMON events are not correctly defined for fault-finder (FFI), SSL, and virus throttling, which causes the switch to report an error such as system: Unknown Event ID 776 when those events occur. Management CR_ In some situations with multiple TELNET and/or SSH sessions established, the switch does not accept additional management sessions even if some of the existing ones are killed, responding with the message Sorry, the maximum number of sessions are active. Try again later. 20 CLI

21 PoE CR_ sflow After disabling PoE on one or more ports, the output of show cpu slot <slot-number> shows an increase in CPU utilization of 15% or more. CR_ SNMP In an IPv6-only environment with Stateless Address Autoconfiguration, sflow incorrectly uses the linklocal address as the agent ID. CR_ After using SNMP to configure a RADIUS server on the switch, the switch does not allow a login until the switch is rebooted. CR_ When using the "createandwait" mode to set parameters via SNMP, multiple RADIUS servers cannot be configured. CR_ The switch incorrectly reports that MIB object entphysicalisfru = False for removable fantrays and transceivers. Switch Hang CR_ TELNET With both authentication and accounting enabled, the switch might become unresponsive to management, requiring a reboot to recover. CR_ While a user is being authenticated by a RADIUS server, issuing the show access-list radius all command from a TELNET session might cause the TELNET session to hang. Web Management CR_ When Spanning Tree Protocol (STP) is enabled via the Web user interface, "mstp" is shown as the default STP mode, and "mstp" is displayed as the operational mode after the user enables STP and saves the change. However, the command line interface shows that the switch operates in "rpvst" mode. Workaround: From the Web user interface, use the dropdown menu to explicitly select "mstp" from the dropdown options, then save the change. PoE 21

22 Version W CLI CR_ Counters The switch does not allow the lockout-mac command to be configured for a MAC address that is all zeros ( ). CR_ The output of show ip counters is incorrect when routing is enabled for IP, IPv6, or multicasts. CR_ When a trunk configured for sflow polling is simultaneously queried via SNMP, all counter values for the trunk are zero. CR_ Crash On a switch configured with rapid PVST and BPDU protection, the output of the command show spanning-tree bpdu-protection shows zero errant BPDUs received, even when the switch has disabled a port due to receiving a BPDU. This is a display issue only, both rapid PVST and BPDU protection function properly. CR_ The switch might reboot unexpectedly in these situations: 1. The switch is running or earlier software, is configured to drop frames that have a destination address of 01:00:0c:cc:cc:cd, and has PVST filtering or PVST protection enabled. Then the switch is updated to or later software. 2. The switch is running or later software, is configured to drop frames that have a destination address of 01:00:0c:cc:cc:cd, and then PVST filtering or PVST protection is enabled. The switch reboots unexpectedly with a message similar to Software exception at bttflearn.c: in 'mlpmgrctrl', task ID = 0xa98a9c0 -> Mac Table Error. CR_ With local MAC authentication enabled, issuing the show run command causes a small decrease in the switch's available memory. Over time if memory becomes depleted, the switch might reboot unexpectedly with a message similar to Software exception at cli_show_config.c: in 'msess6', task ID = 0xa CR_ The switch uses TCP connections internally for inter-process communication. In a situation where an internal loopback TCP socket pair receives stimulus after an extended period of idle time, the switch might reboot unexpectedly with a message similar to NMI event SW:IP=0x00e20c1c MSR: 0x LR:0x00e077d0 cr: 0x sp:0x02b03c58 xer:0x Task='InetServer' Task ID=0xab Version W

23 Display Issue CR_ Fastboot When terminal length is changed from the default of 24, the config file display is truncated, and the outputs of show logging and show interfaces might be interleaved in the output of show tech all. CR_ If the fastboot setting is changed by the user, and the switch experiences a power interruption or reboot while the new setting is being written to flash, upon bootup the MAC address on a switch or stack member might be erased. Note that this fix has a side effect: If the fastboot setting is changed by the user and the switch software is downgraded (changed to an earlier version), upon bootup the fastboot setting might revert to what it was before the user-initiated change, even though the switch reports that it has been changed. Workaround: Change the fastboot setting twice - first change it back to what it was before the userinitiated change, then change fastboot to the desired setting. Flow Control CR_ IGMP With flow control enabled, the switch might not always forward high priority frames (such as Spanning Tree BPDUs) if it has received PAUSE frames from the connected device. CR_ Joins sent by clients in response to a Group Specific Query are not forwarded by the Querier, causing the clients to lose the stream. CR_ IP Phones After disabling IGMP forwarding on a port, multicast traffic incorrectly continues to flow from that port. CR_ MAC Table Alcatel phones might reboot unexpectedly when connected to a switch configured for IP phones to use MAC authentication and for PCs to use 802.1X authentication. CR_ A MAC table entry does not age out while there is traffic destined to the MAC address, even if no traffic is received from that MAC address. Display Issue 23

24 MSTP CR_ Multicast With Spanning Tree enabled, configuring a live port as an admin-edge-port causes the output of show run to display a fixed path-cost for that port in the IST (for example, spanning-tree instance ist 5 path-cost 20000). Note that this is a display issue only, the switch uses the automatic path-cost based on the link speed. CR_ Stacking When a multicast stream is sent to a reserved multicast address, a General Query might not be not forwarded by the switch, causing clients to be dropped from the multicast stream. CR_ With the default terminal size of 80x24, connecting to the stack commander via TELNET or SSH results in the list of stack member switches displayed below the command prompt, with each additional member overwriting the previous one, leaving only the last stack member visible to the user. Transceivers CR_ Software does not allow the dual-speed J8177C Gigabit-copper transceiver to be configured for 100 Mbps operation, responding with a message such as Value auto-100 is not applicable to port A21. This is the same fix as CR_ in , which was inadvertently removed by CR_ in software. Version W RADIUS CR_ In some situations, the switch response to "Change of Authorization" and "Disconnect Messages" from the RADIUS server is sent from an incorrect source IP address, which the RADIUS server therefore ignores. Version W Version W was never built. Version W Version W was never built. 24 MSTP

25 Version W X CR_ Accounting After 802.1X frame counters reach a maximum value of 2,147,483,647, the counters are displayed as negative values that become smaller until they reach zero. When the counters reach zero, they begin incrementing again. CR_ If a Windows system is configured for both computer authentication and user authentication, accounting might not function properly. Authentication CR_ CLI With both 802.1X and MAC Authentication configured on a port, it is possible for an already-authenticated client to be erroneously moved to the unauthenticated VLAN. CR_ CLI output for show ip igmp vlan x conf displays a plus sign under the Interconnect Trunk column heading, and nothing (blank) under the Port column heading. CR_ Config The error message is not clear when the user attempts to create an overlapping network on a switch. This fix was inadvertently omitted from the original W fix list. CR_ A switch that is upgraded from K.14 to K.15 software or from W.14 to W.15 software has a tilde erroneously added to the community name specified in the snmp-server host command. CR_ Setting an operator or manager password on the switch causes four features to be disabled: auto run, DHCP-based config file download from an external tftp server, DHCP-based software image download from an external tftp server, and tftp server functionality within the switch. With this fix, more accurate messages are sent regarding the specific features that are disabled by setting the operator or manager password. CR_ After boot, a config file that has a trap destination community name with an open parenthesis "(" or a close parenthesis ")" cannot be downloaded to the switch. Version W

26 CR_ After a switch software update, SNMP community access privileges are incorrectly changed by the switch. The output of show snmp-server and the output of a "walkmib" command give different results, and neither output represents how the switch actually behaves for Manager or Operator access. This issue was introduced with CR_ ; if the access settings were configured on a switch without the CR_ fix, after updating to software with the CR_ fix the settings are changed. CR_ Crash When a configuration file is downloaded to the switch, a default SNMPv3 user named "initial" is created on the switch even though it is not in the config file. CR_ The switch might reboot unexpectedly with a message similar to NMI event SW:IP=0x MSR:0x LR:0x cr: 0x sp:0x xer:0x Task='InetServer' Task ID=0xaad3000. CR_ In a rare situation the switch might reboot unexpectedly with a message similar to Software exception at rt_table.c: in 'eroutectrl', task ID = 0xa9c4c00 -> Routing Stack: Assert Failed. This improves the original Crash fix (CR_ ). CR_ With SNTP configured, in a rare situation after a time update the switch might reboot unexpectedly with a message similar to Health Monitor: Invalid Instr Misaligned Mem Access HW Addr=0x31352e30 IP=0x31352e30 Task='mDebugCtrl' Task ID=0x3c9558c0 sp: 0x11f92cd0 lr:0x31352e31 msr: 0x xer: 0x cr: 0x CR_ DHCP After boot, a switch that has a syslog server and an IPv6 address configured might become unresponsive to management, and after a period of time the switch might reboot repeatedly with a message similar to NMI event SW:IP=0x001517d4 MSR:0x LR:0x c cr: 0x sp: 0x03aae0e0 xer:0x Task='mDebugCtrl' Task ID=0xa9f8000. CR_ If the switch is a DHCP client and the DHCP reply contains option 43 with sub-option codes that conflict with RFC 2132 options, the switch might use incorrect settings such as an incorrect subnet mask. CR_ A switch acting as a DHCP relay agent sends two DHCP packets, one of which incorrectly has the source MAC address of the client instead of the switch. 26 Crash

27 Event Log CR_ GVRP After the switch uptime reaches 497 days, the timestamp entries in the event log become erratic with gaps of several hours or days. In some cases the timestamps revert to previous months and years, even though SNTP updates with those wrong timestamps report the correct date and time. CR_ ICMP After rebooting the switch, the configuration unknown-vlans disable does not work on trunks. CR_ The switch does not log an unsolicited ICMP reply unless it has first pinged some (any) IP address. Also, unsolicited ICMP reply log messages are sometimes associated with the DEFAULT_VLAN instead of the VLAN of the incoming unsolicited ICMP reply. CR_ IGMP Although the RFC requires that the switch with the lowest IP address becomes querier, a switch that is acting as querier stops being querier when it receives a query from a switch with a higher IP address. CR_ The switch sends an IGMP General Query with an incorrect layer 2 destination address. CR_ A non-querier switch that receives a Join from the querier fails to send further Joins to the querier, resulting in loss of multicast traffic. Jumbo Frames CR_ Link When jumbo frames are enabled on any VLAN, OSPF fails to establish an adjacency after a switch reboot, and RIP updates might not be accepted by the router. CR_ Gigabit fiber transceivers operate in auto-negotiation mode even if the port is configured for 1000 Mbps full-duplex operation (speed-duplex 1000-full). If both sides of the link were configured as 1000-full, the link will go down after the switch at one side of the link is updated with affected software. This issue was introduced in software version Event Log 27

28 Loop Protection CR_ Loop protection fails to detect a loop on a port configured for 802.1X authentication, if 802.1X is not enabled globally. MAC Authentication CR_ OpenFlow MAC Authentication fails when the peap-mschapv2 parameter is included in the aaa authentication CLI command. CR_ Passwords OpenFlow flows are not programmed correctly when RPVST+ is disabled on the OpenFlow member VLAN. CR_ If the switch is configured with a username and password, changing the password causes the username to also change. The username is changed to the default "manager" or "operator", depending which password is changed. RADIUS Accounting CR_ Routing An interim-update status request generates incorrect accounting information in the RADIUS server. This issue was introduced with CR_ CR_ sflow The switch does not forward traffic to a host that has a static route configured with a 32-bit subnet mask. Traces show that the switch never sends an ARP request for that host. CR_ When an sflow-sampled inbound packet is to be routed, the sflow data gives the wrong output port on the switch. CR_ sflow sampling of multicast packets sometimes results in duplicate packets that can cause pixelation of video or other degradation of the multicast stream. 28 Loop Protection

29 SNMP CR_ After rebooting a switch configured for SNMP with the parameters operator unrestricted, the switch does not allow the user to set any read/write MIB objects. CR_ SSH A trap from an undocumented OID can be triggered under certain conditions. With this fix, OID has been added to the MIB. CR_ SSL The output of show ip ssh lists incorrect port numbers for the clients. CR_ Stacking A self-signed certificate cannot use a common name (CNAME) longer than 40 characters. With this fix, the limit is 90 characters. CR_ TFTP When stacking is enabled, the switch is accessible via the Web even after disabling the Web server, and via TELNET even after disabling TELNET. CR_ TFTP file transfers initiated via TELNET or SSH fail, if the console inactivity-timer setting causes the TELNET or SSH session to end during the transfer. This issue does not affect file transfers initiated via the console or via SFTP. Transceivers CR_ Software does not allow the dual-speed J8177C Gigabit-copper transceiver to be configured for 100 Mbps operation, responding with a message such as Value auto-100 is not applicable to port A21. CR_ Megabit transceivers might have one or more of these symptoms: 1. Link LED is lit but link is down 2. No Link after the transceiver is hot-swapped 3. Transceiver fails self test SNMP 29

30 Trunking CR_ The switch does not allow a static LACP trunk to be configured as active or passive. This fix adds a new interface command: lacp static [active passive]. Web Management CR_ The "Rx Errors" column is missing from the Web user interface. CR_ A self-signed SSL certificate generated via the Web interface cannot use a common name (CNAME) longer than 40 characters. With this fix, the limit is 90 characters. Upgrade information Upgrading restrictions and guidelines W uses BootROM W If your switch has an older version of BootROM, the BootROM will be updated with this version of software. For more information about BootROM, see the Management and Configuration Guide for your switch. IMPORTANT: During the software update, the switch will automatically boot twice. The switch will update the primary BootROM, then reboot, and then update the secondary BootROM. After the switch flash memory is updated and the final boot is initiated, no additional user intervention is needed. Do not interrupt power to the switch during this important update. 30 Trunking

31 Hewlett Packard Enterprise security policy A Security Bulletin is the first published notification of security vulnerabilities and is the only communication vehicle for security vulnerabilities. Fixes for security vulnerabilities are not documented in manuals, release notes, or other forms of product documentation. A Security Bulletin is released when all vulnerable products still in support life have publicly available images that contain the fix for the security vulnerability. Finding Security Bulletins Procedure 1. Go to the HPE Support Center - Hewlett Packard Enterprise at 2. Enter your product name or number and click Go. 3. Select your product from the list of results. 4. Click the Top issues & solutions tab. 5. Click the Advisories, bulletins & notices link. Security Bulletin subscription service You can sign up at www4.hpe.com/signup_alerts to initiate a subscription to receive future Hewlett Packard Enterprise Security Bulletin alerts via . Hewlett Packard Enterprise security policy 31

32 Websites Networking Websites Hewlett Packard Enterprise Networking Information Library Hewlett Packard Enterprise Networking Software Hewlett Packard Enterprise Networking website Hewlett Packard Enterprise My Networking website Hewlett Packard Enterprise My Networking Portal Hewlett Packard Enterprise Networking Warranty General websites Hewlett Packard Enterprise Information Library For additional websites, see Support and other resources. 32 Websites